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1 Project Objectives 


The developer”s serial bootloader for M68HCO8 and 
HCSO8 microcontroller units (MCUs) allows in-circuit 
reprogramming of Freescale Semiconductor”s 
M68HC08 and HCSO8 FLASH devices using standard 
communication media such as a serial asynchronous 
port. As soon as the MCU is programmed with the 
bootloader, the MCU memory can be modified in-circuit. 
Because ofits ability to modify MCU memory in-circuit, 
the serial bootloader is a utility that may be useful in 
developing applications. 


This application note is for embedded-software 
developers interested in alternative reprogramming 
tools. The developer”s serial bootloader is not intended to 
compete with existing MONOS8 development tools; itis a 
complementary utility for either demo purposes or 
applications originally developed using MMDS and 
requiring minor modifications to be done in-circuit. The 
serial bootloader offers a zero-cost solution to 
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Project Objectives 


applications already equipped with a serial interface and SCI pins available on a connector. This document 
also describes other programming techniques: 


* FLASH reprogramming using ROM routines 

* Simple software SCI 

* Use of the internal clock generator 

* PLL clock programming 

* EEPROM programming (AS/AZ HCO08 families) 





HC08 embedded application 
(under development Windows or Linux PC 


or under re-configuration) 





Figure 1. Top Level View 


1.1 Project Goals 


Freescale Semiconductor M68HC08 MCUSs use a standard monitor-mode interface for FLASH 
programming. Configuration of monitor mode requires a specific clock and high voltage (monitor-mode 
entry voltage Vrsr = Vpp + 2.5 = 8 V) applied to the IRQ pin upon MCU startup. Also, establishing 
monitor-mode communication uses a few pins. If the application already uses a standard serial SCI 
interface for communication, a different code (the bootloader) can be used to communicate with the PC 
using the same interface used for reprogramming. 


The bootloader can be used for only reprogramming, not for in-circuit debugging. The bootloader is a 
low-cost, in-circuit programming solution. 


1.2 Bootloader Application Requirements 


* Low memory use — The bootloader must use as little memory as possible. Other versions of 
bootloaders use more than 1 KB of memory, which is unacceptable on devices with 3 KB of 
memory available (such as the MC68HC908JK3). The solution described in this document 
implements all features as simply as possible, excluding checksums, etc. The target size 1s less than 
500 B. 


* Low pin-count — This bootloader uses standard (already implemented) means of communication 
(typically SCI on boards primarily intended for communication). The standard SCI uses two wires 
(RxD, TxD). No additional wires are used to start bootloader. 
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FC Protocol Description 


e Transparency with respect to the user S19 file — The complete application should be 
transparent to the user code S19 file. This means no adjustments are required in the S19 file. Other 
M68HC08 and HCSO8 bootloader applications require modification to interrupt vectors or other 
modifications to the S19 file for it to accept the bootloader. 


1.3 Demo Features of Bootloader Application 


This document describes several different M68HC(S)08 bootloader implementations that vary mainly 
because the target M68HC(S)08 MCUs have different features. Several features of the M68HC(S)08 
Family are also demonstrated, making this document useful to a wider audience than those who require 
only the bootloader. The different M68HC(S)08 implementations also demonstrate the following features: 
* Use of built-in ROM routines for FLASH self-programming (see also AN1831/D, AN2545/D and 
AN2635/D in References). 
* User implementation of in-circuit reprogramming routines on ROM-less MCUSs such as the 
MC68HC908GP Family or the MC9S08GB/GT Family 
* Use of different implementations of the FLASH block protection technique (MC68HC908GP, 
MC68HC908GR, MC68HC9OBEY, vs. MC68HC9OSJK/JL Families) 
* Implementation of software SCI on SCI-less MCUs, such as the MC68HC90O8JK/JL Family 
* Useofthe internal clock generator and its trimming (for the MC68HC908KX Family), for HCSO8 
Families (MC9S08GB/GT) 
* EEPROM programming (for the MC68HC9O8SAB/AS/AZ Family) 
* USB communication implementation on USB2.0 Full-speed HSO08 MCUSs, such as the 
MC68HC908JW Family 


2 FC Protocol Description 


As described in Bootloader Application Requirements an implementation must be as simple as possible 
and use as little memory as possible. Therefore, the protocol running between the master PC and slave 
MCU is also very simple. It is called FC protocol because one significant character (the acknowledge, or 
ACK) $FC or 11111100b is used. 


This section describes the protocol used to communicate between the PC and target MCU to reprogram 
the MCU. An explanation of family-specific implementation features follows a general description. 


Figure 2 1s a simplified state diagram that shows separate states of the bootloader, which this document 
describes. 
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Figure 2. Simplified Flow Diagram of the Bootloader Application 


2.1 Initial-Hook Up 


Several methods exist to enter bootloader mode. Several other solutions use a “certain level on certain 
pin” method. An example of this: If logic O appears on an IRQ pin during MCU startup, the bootloader 
code starts. Otherwise, the user code starts. 


Because the developer”s serial bootloader application must use the lowest number of pins, a “certain 
character at a certain time” method is used. This means that the MCU sends out an ACK character through 
the serial interface and waits for an answer. If no character is received within the specified time (hook-up 
time-out), the process continues with the user code. 


If this becomes a limitation for any reason, the user may modify the bootloader code to meet the 
application needs (e.g., an additional simple IRQ pin test at startup can be implemented). See more in 
M68HCO08 System Limitations. 


2.2 Clock Source 


FC protocol allows two scenarios, depending on whether the MCU runs on a known and exact frequency 
or uses an RC (resistor, capacitor) clock or an internal clock (or any clock unknown at compile time). 


2.2.1 Unknown MCU Communication Speed 


If the frequency is uncertain (unknown at compile time), the MCU will not check if an incoming ACK 
character conforms only to the $FC pattern. Because of the MCU clock tolerance, several characters can 
be interpreted differently instead of the original $FC sent out by the PC (Figure 3). The $FC pattern check 
on the MCU side can be eliminated completely, which saves MCU memory. 
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Figure 3. Matching Different Communication Speeds 


Table 1 shows the characters that can be correctly received (i.e., without framing or noise errors) 1f 
transmit and receive speeds are not equal. 


Table 1. PC to MCU Transmission — Unmatched Data Rate 
































Character Character 
PC Data Rate MCU Data Rate Received Received 
in Binary in Hex 
9600 9600*1/3 11111111b SFF 
9600 9600*2/3 11111110b SFE 
9600 9600*3/3 11111100b SFC 
9600 9600*4/3 11111000b sF8 
9600 9600*5/3 11110000b SFO 
9600 9600*6/3 11100000b SEO 
9600 9600*7/3 11000000b SCo 
9600 9600*8/3 10000000b 880 
9600 9600*9/3 00000000b 800 




















If the MCU transmits to the PC at an unmatched data rate, the PC receives (and accepts) characters that 
are different from the $FC character. The PC accepts all characters from the mentioned set (SFF, $FE, $FC, 
$F8, $FO, $E0, $C0, $80, 800). If a character is received, an ACK is immediately sent back to the MCU. 
After the MCU recognizes this answer, it enters the next phase, Slave Frequency Calibration. 
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2.2.2 Known MCU Communication Speed 


If the frequency is certain (known at compile time), the MCU will be configured to match exactly the 
communication speed of the PC. All characters are received correctly and without distortion. 


The MCU sends $FC to the PC, which immediately sends an ACK to the MCU. After the ACK is received, 
the MCU also (formally) enters the Slave Frequency Calibration phase. 


2.3 Slave Frequency Calibration 


During this phase, the MCU clock is calibrated. Until now, the PC has communicated with the MCU at a 
speed that could be from 33% to 300% tolerance. During this phase, the MCU communication speed must 
be adjusted to match the PC communication speed. 


After the PC enters the calibration phase, the no-break time-out starts. If a correct ACK character ($FC) is 
not received within this period, a break character is sent at the communication data rate. 


A break character consists of 10 consecutive logical zeros. For example, at a 9600 baud data rate, its 
high-low-high pulse lasts 10 x 104 us = 1.04 ms. 


The MCU then measures the break character length and determines whether its clock is too fast or too slow. 
The MCU then makes an adjustment to its system clock (or an adjustment of receive routines 1f, for 
example, software serial communication is used). This can be repeated as many times as needed for the 
MCU to achieve the proper clock speed. 


After the MCU is calibrated to the correct clock (or after the receive routines are calibrated), the ACK 
character is sent to the PC to stop sending calibration characters (Figure 4). 
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Figure 4. Start-Up Communication with Calibration 


If the MCU is operating at the correct data rate (no calibration is possible or needed, and the MCU clock 
is crystal driven), the PC can immediately send an ACK, skipping the calibration phase entirely 
(Figure 14). 
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Figure 5. Start-Up Communication Without Calibration 


2.4 | Interpreting MCU Commands 


After communication between the MCU and the PC is established, the MCU enters the main command 
interpreter loop. The MCU executes simple commands to reprogram its own nonvolatile memory. The 
communication is conducted on a master-slave mechanism: the PC issues the commands, the MCU 
executes them and acknowledges the completion of each command, either by data or by a single ACK 
character. 
The minimal set of commands is comprised of: 

* Ident Command 

* Quit Command 
Two more basic commands are implemented for pure reprogramming: 

* Erase Command 


e Write Command 


If the user needs a verification feature, one additional (read) command must be compiled into the MCU 
code. For pure reprogramming purposes (minimal configuration), it is not required. 


e Read Command 
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PC TO MCU COMMAND 


COMMAND 


MCU TO PC RESPONSE 













LENGTH DATA TO MCU 













DATA FROM MCU 


* Dashed fields are not always implemented, data from the MCU may contain only an ACK character instead. 


Figure 6. Typical Command and Response 


2.4.1 Ident Command 
The indent command (coded as “T”, $49) has no additional fields. 


This command is immediately issued by the PC after communication is established. The purpose of the 
indent command is to let the PC know several basic properties of the MCU being programmed. All 
multi-byte fields are sent with MSB first. 


* Version number and capability table — 1 byte 


BIT 7 6 5 4 3 2 1 0 


RCS RESERVED VERSION NUMBER 


Figure 7. Version Number and Capability Table 
RCS — Read Command Supported Flag 


The RCS flag informs the PC if the read command is supported (implemented). If not, all calls to the read 
routine are ignored by the MCU and no response is sent back to the PC. The PC software warns the user 
that no read capabilities are available. 


Supported 

Not supported (usually due to memory constraints) 

RSVD — Reserved 

These bits are reserved for future use, unused, and should be set to O. 


VER — Protocol Version 


2.4.2 FC Protocol Version 1 (M68HC08) 
Version 1 of the protocol is for M68HCO8 MCUSs. In version 1, additional fields are defined as: 


e Start address of reprogrammable memory area — 2 bytes 
* End address of reprogrammable memory area + 1 — 2 bytes 
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e Address of Bootloader User Table — 2 bytes 

e Start address of MCU interrupt vector table — 2 bytes 
* Length of MCU erase block — 2 bytes 

* Length of MCU write block — 2 bytes 


* Bootloader data (specific bootloader info, see device-specific implementation; compared in 
Table 2) — 8 bytes 


* Identification string, zero terminated — <n> bytes 
PC TO MCU COMMAND 


| ($49) 





>— 
ed START|| END ||BOOTLOADER]| INTERRUPT ERASE WRITE BOOTLOADER 
CAPS. MEM MEM || USER TABLE || VECTOR TABLE || BLOCK SIZE || BLOCK SIZE DATA STAN 
MCU TO PC RESPONSE 


Figure 8. Ident Command (FC Protocol Version 1, M68HC08) 


2.4.3 FC Protocol Version 2 (HCS08) and FC Protocol Version 3 (large 


M68HC08) 


Version 2 of the protocol is for HCS08 MCUS; version 3 is for large M68HCO08 (HC08 with two or more FLASH memory banks). In both versions, additional fields 


are defined as: 
* System device Identification register content — 2 bytes (unused in protocol version 3, coded as 


$FFFF) 
* Number of reprogrammable memory areas (N) — 1 byte 
* Start address of reprogrammable memory area É1 — 2 bytes 
* End address of reprogrammable memory area $l + 1 — 2 bytes 
e Start address of reprogrammable memory area $2 — 2 bytes 
* End address of reprogrammable memory area $2 + 1 — 2 bytes 


e Start address of reprogrammable memory area EN — 2 bytes 

* End address of reprogrammable memory area fN + | — 2 bytes 
e Address of relocated interrupt vector table — 2 bytes 

* Start address of MCU interrupt vector table — 2 bytes 

e* Length of MCU erase block — 2 bytes 

* Length of MCU write block — 2 bytes 

e Identification string, zero terminated — <n> bytes 
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PC TO MCU COMMAND 


>— 
VERSION H START || END RELOCATED INTERRUPT || ERASE WRITE ID 
De SDID OF MEM || MEM 41 || MEM 1 E VECTOR TABLE VECTOR TABLE |] BLOCK SIZE BLOCK SIZE || STRING 


MCU TO PC RESPONSE 


| ($49) 





Figure 9. Ident Command (FC Protocol Versions 2 and 3, HCS08) 


2.4.4 Erase Command 


The erase command (coded as “E”, $45) has only an address field, no length or data fields. The start address 
is a 2-byte field, MSB first. 


The MCU erases the address block where the specified address resides. The length of block to be erased 
is equal to the erase-block size (typically dependent on hardware). 


After the MCU completes execution of the command, the ACK ($FC) character is sent back to the PC. The 
erase command”s minimum and maximum execution times are not specified. 


PC TO MCU COMMAND 


START 
COMMAND EXECUTION 


MCU TO PC RESPONSE ACK 
Figure 10. Erase Command 


2.4.5 Write Command 


The write command (coded as *W”, 857) has both address and data fields. The address contains the first 
address to be programmed. The first byte is the length followed by the number of bytes to be programmed. 
The start address is a 2-byte field, MSB first. The length is a 1-byte field. 


After the MCU completes execution of the command, the ACK ($FC) character is sent back to the PC. The 
write command”s minimum and maximum execution times are not specified. 
PC TO MCU COMMAND 


START 
W ($57) ADDRESS LENGTH BINARY DATA 
COMMAND EXECUTION 


MCU TO PC RESPONSE ACK 


Figure 11. Write Command 
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2.4.6 Read Command 


The read command (coded as “R”, 852) has address and data fields. The address contains the first address 
to be programmed; the single byte is the length of data to be read. The start address is a 2-byte field, MSB 
first. The length is a 1-byte field. 


The MCU sends this number of read bytes back to the PC. 


PC TO MCU COMMAND 


START 
BINARY DATA 
MCU TO PC RESPONSE 


Figure 12. Read Command 





2.4.7 Quit Command 


The quit command (coded as *Q”, $51) has no address or data fields. Execution of bootloader code is 
finished immediately, and the user code is started. No ACK ($FC) character is sent back to the PC. 


PC TO MCU COMMAND 


Q ($51) 





<NO RESPONSE> 
MCU TO PC RESPONSE 


Figure 13. Quit Command 


2.4.8 Bootloader User Table 


The bootloader user table is a reprogrammable memory area intended for storage of bootloader-specific 
data. This memory area is unavailable for the user program. For this tables memory allocation refer to FC 
Protocol, Version 1, M68HC908 Implementation. 


3 FC Protocol, Version 1, M68HC908 Implementation 


This section describes features specific to the M68HC908 bootloader implementation. The memory 
allocation is heavily MCU specific, so the meaning of all variables is explained in this section in detail. 


Figure 2 shows the typical memory allocation for M68HC908 MCUSs with the bootloader 
pre-programmed. For example, the MC68HC908KX8 MCU memory map includes: 


* 7680 bytes of FLASH memory ($E000-$FDFF) 


Developer's Serial Bootloader for M68HC08 and HCS08 MCUS, Rev. 8 


12 Freescale Semiconductor 





FC Protocol, Version 1, M68HC908 Implementation 


* 192 bytes of random-access memory (RAM) ($0040-$00FF) 
* 36 bytes of user-defined vectors (BFFDC-$FFFF) 


OxFFFF 


OxFFDC 
UNIMPLEMENTED AREA THIS AREA OF FLASH IS PROTECTED 
OxFEOO 


USING FLBPR REGISTER 


BOOTLOADER CODE 
OxFCCO 
OxFC80 
FLASH MEMORY AVAILABLE 
ON MC68HC90BKXB MCU 
RES nENIGiGAREi FLASH Eu 
FOR USER CODE FOR USER CO 
0xE000 
UNIMPLEMENTED AREA 
0x0100 


0x0040 
/O REGISTERS 0x0000 


Figure 14. Simplified Example of Memory Allocation in MC68HC908KX8 





3.1 Memory Allocation 


The bootloader code occupies the top end of FLASH memory (the highest memory address space). This 
placement allows an effective use of the FLASH block-protection technique (see the specific MCU data 
sheet for details). 


3.2 FLASH Block Protection Register (FLBPR) 


By setting a FLBPR (FLASH block-protection register), all address space above this address is protected 
from intentional and unintentional erasing/re-writing. After both bootloader and FLBPR register are 
programmed into memory, the bootloader code is protected from unintentional modification by user code. 


NOTE 
Some M68HC908 MCUS have an FLBPR register in RAM instead of 
FLASH (e.g., the MC68HC908JK/JL Families). The bootloader code sets 
this register properly but the user code can eventually modify FLBPR and 
erase/write the bootloader code. See FLBPR Not Usable (in Some 
M68HC08 Family MCUS). 
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For example, the MC68HC908K X8 bootloader to the PC memory allocation is: 
* $01 — Version 1, read command not implemented (bit 7) 
* $E000 — Start address of reprogrammable memory area 
* $FC80 — End address of reprogrammable memory area + 1 
* S$FC80 — Address of Bootloader User Table 
* $FFDC — Start address of MCU interrupt vector table 
* -$0040 — Length of MCU erase block 
* $0020 — Length of MCU write block 


* 0,0,0,0,0,0,0,0 — Bootloader data. No strictly defined syntax; different M68HCO8 
implementations provide different values (e.g., the sixth value in the MC68HC908KX8 
implementation is the value of the internal clock generator [ICG] trim register after calibration). 
All these bootloader data are then programmed back into the bootloader user table and can be 
retrieved during all subsequent starts (e.g., to trim the MCU*s ICG to the best-known value before 
user code start). 


* “KX8-IR',0 — Identification string, zero terminated. Information to be displayed on PC screen. 


3.3 | Interrupt Vector Table Relocation 


Because the FLASH block-protection technique also protects the interrupt vector table from being 
overwritten, some method must be used to relocate these vectors to the different locations. To do this, the 
bootloader user table is used. Itis a part of memory not protected by the FLBPR, but it is unavailable to 
the user program. All standard interrupt vectors are pointing to this table where JMP instructions are 
expected to be stored for each interrupt. The only exception is the reset vector that points to the bootloader 
code start. When an interrupt occurs, the vector is fetched from protected memory and directs execution 
to continue at the corresponding JMP instruction in the bootloader user table. 


Figure 15 shows interrupt vector table relocation for M68HCO8 MCUSs. Note that in a standard interrupt 
vector table, each record is 2 bytes long (each vector is a 16-bit address). This is different from the 
bootloader user table, for which each record is 3 bytes long — a JMP opcode ($CC) plus a 16-bit address. 
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INTERRUPT VECTOR TABLE 


RESET VECTOR OXFFFE 
INTERRUPT VECTOR 1 OXFFEC 
INTERRUPT VECTOR 2 OXFFEA 
INTERRUPT VECTOR 3 
OxFFES BOOTLOADER CODE 















































Pe! a 
OxFFEO 
INTERRUPT VECTOR 16 | oxFFDE 
INTERRUPT VECTOR 17 | oxFFDC 
BOOTLOADER USER TABLE 0xFCCO 
JMP USER INT. VECT. 17 OxFCBB 0xFDOO 
JMP USER INT. VECT. 16 XE GEE 
OxFC84 
JMP USER INT. VECT. 3 pires] 
JMP USER INT. VECT. 2 MEGaE 
JMP USER INT. VECT. 1 OxFCSB 
USER CODE 
JMP USER RESET VECTOR | oyrcgs 
START (RESET) 






BOOTLOADER DATA 






OxFC80 


INTERRUPT ROUTINE 1 








INTERRUPT ROUTINE 2 


INTERRUPT ROUTINE 16 
INTERRUPT ROUTINE 17 


Figure 15. Interrupt Vector Table Relocation (M68HC08 MCUSs) 





3.3.1 S19 File 


Because the bootloader operation must be transparent to the user S19 file, another piece of intelligence is 
built into the PC master code (instead of the MCU slave). The relocation works like this: 


If the data from an S19 record corresponds to an address in the interrupt vector table, the value is relocated 
into the corresponding area in the bootloader user table, including a JMP instruction (opcode $CC). For 
example, if the user S19 file contains 43 interrupt vector $E 123 at address $FFES8, such a vector is 
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relocated into the sequence $CC, $E1, $23 (JMP $E123) programmed to the $FC81 address in the 
bootloader user table. 


Using this method, the user S19 file does not need to be modified, but the lower address of the end of 
FLASH memory must be considered. Also, this JMP instruction (3T) delays every interrupt, as explained 
in Each Interrupt 3T Delayed. 


3.4 User Code Start 


The user code is started in an unusual way to provide a register setup similar to how it appears after MCU 
reset. 


3.4.1 Software Reset 


If the bootloader must quit and run user code, an illegal operation is intentionally executed (M68HC08 
illegal opcode $32). This causes an illegal operation reset, and the MCU restarts. During bootloader 
startup, the system integration module (SIM) reset status register (SRSR) is tested. If a power-on-reset is 
not detected, the user code is started instead of the bootloader code. This allows the transparent operation 
of all other resets (such as illegal address, etc.) with only a short additional delay caused by testing the 
SRSR register and executing associated jump instructions. 


3.4.2 Hardware Reset 


In some implementations, a pin reset (caused by external reset pin) is also included as a valid source of 
reset for the bootloader to start. This allows remote in-circuit reprogramming in embedded applications 
able to drive the M68HCO8 reset pin. 


Another test has been added to the real bootloader application: if no reset source is detected (i.e., if the 
SRSR register is 0), the bootloader is selected by default. This may happen when an external pin causes 
reset, but the reset pulse is shorter than specified. In that case, the minimum length of reset pulse that will 
cause reset is shorter than the length needed for the proper propagation of the external reset flag to the 
SRSR register. 


Because the SRSR register is one-time readable (it clears after read), no subsequent reads of this register 
provide a valid value. See M68HCO8 System Limitations for details. 


3.5 'M68HC08 System Limitations 


This section summarizes limitations that must be considered when using the bootloader with the user 
application. 


3.5.1 Memory Occupied 


One of the most important requirements is to use the smallest code possible. Typical M68HC908 
implementations are between 300 and 500 bytes, including the bootloader user table. If the target 
M68HC08 MCU is capable of FLASH programming using internal ROM routines, the memory 
consumption is near the lower limit. Larger M68HCO8 MCUSs (which are not usually equipped with ROM 
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code for FLASH programming) will require approximately 500 bytes of FLASH of the total 32 KB (as is 
the case with the MC68HC908GP32). 


The bootloader is placed at the upper end of FLASH memory; therefore, the only modification required in 
the user code is in the memory mapping (typically found in the linker parameter file). 


The M68HC08 MCU signals the actual available FLASH addresses. The PC Bootloader software will not 
allow programming 1f the user code overlaps with bootloader code. 


3.5.2 Time Delay Upon Start-Up and Initial Communication 


The number of pins with specific meanings during bootloader start-up must be as small as possible. 
Especially in communication systems (e.g., those using a standard serial port), pin overhead is zero and a 
“certain level character at a certain time” method is used. So, the bootloader waits a certain amount of 
time to receive an answer from the PC at startup. If none is received, the user code starts. The typical delay 
is in the range of several hundred milliseconds. 


If this start-up delay becomes an issue for the final application, the user may modify the bootloader code 
and use a “certain level on a certain pin” method instead. A simple test of the voltage level on the IRQ pin 
(or any other input pin) can be used to indicate whether the bootloading sequence is required. 


3.5.3 Each Interrupt 3T Delayed 


Every interrupt call is delayed by 3T bus clocks required to execute the JMP instruction stored in the 
bootloader user table. This interrupt vector relocation (as described in Interrupt Vector Table Relocation) 
has been chosen as the best solution for achieving user code transparency and security of the bootloader 
code. 


The interrupt latency is about 10 to 15T (assuming that no interrupt is being executed), so this additional 
delay is not significant for the most applications. 


3.5.4 FLBPR Not Usable (in Some M68HC08 Family MCUs) 


The bootloader uses a FLASH block protection technique to protect itself from being overwritten (where 
applicable; see FLASH Block Protection Register (FLBPR) for details). 


Some M68HC08 MCUS (such as the KX, GP, and GR devices) have this FLASH block-protection register 
stored in FLASH, so it cannot be modified in user mode. The FLBPR can be erased or programmed only 
with an external voltage, Vrsr, present on the IRQ pin (normal monitor mode). Because this feature is 
completely dedicated to bootloader code protection, it is unavailable to the user application code. If the 
value for FLPBR appears in the user S19 code, a warning is displayed. Such an occurrence should be 
omitted from user S19 code. 


Some families have the FLASH block protection register stored in RAM instead (the MC68HC908JK/JL 
Families are like this). The bootloader sets the correct value at the beginning of its execution to protect 
itself. However, user code can modify this register and protect its own memory areas as needed. This also 
implies that the bootloader is not 100% protected from user code. 


See the specific MCU data sheet for a detailed explanation. 
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3.5.5 SRSR Register Unusable 


The bootloader uses an SRSR register (as described in User Code Start) to recognize the reset source to 
determine whether the user code will run. Because the SRSR register is one-time readable (i.e., 1t is reset 
after first read), the user code does not have access to the SRSR value (if the bootloader is present in the 
memory and makes the first read after each reset). There is no simple remedy for this situation. After the 
SRSR register is read by the bootloader, it is stored in one RAM location. Unfortunately, its memory 
location may differ from one implementation to another. If the application requires the SRSR register and 
bootloader, the user must redirect the SRSR reading to this specific RAM location. This location can be 
obtained from the bootloader's MAP file. 


4 FC Protocol, Version 2, HC9S08 Implementation 


This section describes features that are specific to the HC9SO08 bootloader implementation. The memory 
allocation is heavily MCU specific so the meaning of variables is explained in this section. 


Figure 16 shows the memory allocation typical to the HC9S08 devices with the bootloader 
pre-programmed. For example, the MC9S08GB/GT60 device memory map includes: 

* 60 Kbytes of FLASH memory ($1080-$17FF, $182C-$FFAF) 

* 4 Kbytes of random-access memory (RAM) ($0080-$107F) 

* 16 bytes of nonvolatile registers ($SFFBO-SFFBF) 

* 64 bytes of user-defined vectors (SFFCO-S$FFFF) 


OxFFFF 


OxFFCO 
THIS AREA OF FLASH IS PROTECTED 
OxFFBO 


BOOTLOADER CODE 


OxFEOO 
OxFDCO 
FLASH MEMORY AVAILABLE 
FLASH 58772 BYTES ON MC9S08GB/GT60 MCU 
FLASH MEMORY AVAILABLE 
0x182C FOR USER CODE 
HIGH PAGE REGISTERS 
0x1800 


FLASH 1920 BYTES 
0x1080 


RAM 


0x0080 
O REGISTERS 
0x0000 


Figure 16. Simplified Example of Memory Allocation in MC9S08GB/GT60 
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4.1 Memory Allocation 


The bootloader code occupies the top end of FLASH memory (the highest memory address space). This 
placement allows an effective use of the FLASH protection technique (see specific MCU data sheet for 
details). 


4.2 FLASH Protection 


By setting a FLASH protection register, all address space above this address is protected from both 
intentional and unintentional erasing/re-writing. After the bootloader and the FLASH protection register 
are programmed into memory, the bootloader code is protected from unintentional modification by user 
code. 
NOTE 
See FLASH Protection Technique Not Usable for limitations. 


4.3 Example Memory Allocation 
For example, the MC9S08GB/GT60 bootloader to the PC memory allocation is: 


* $82 — Version 2, read command implemented (bit 7) 


* $r002 — System device identification register (SDIDR) content ($002 for GB/GT Family, r (four 
top bits) is chip revision number reflecting current silicon level 


* $02 — Number of reprogrammable memory areas 

* $1080 — Start address of reprogrammable memory area *1 

* $1800 — End address of reprogrammable memory area $1 + 1 

* $182C — Start address of reprogrammable memory area *2 

* - $FDCO — End address of reprogrammable memory area 42 + 1 

* $FDCO — Address of relocated interrupt vector table 

* $FFCO — Start address of MCU interrupt vector table 

* $0200 — Length of MCU erase block 

* $0040 — Length of MCU write block 

*'GB/GT60”,0 — Identification string, zero terminated. Information to be displayed on PC screen 





4.4 | Interrupt Vector Table Relocation 


If FLASH protection is enabled, the reset and interrupt vectors would be protected. Vector redirection 
(HCSO8 hardware feature) allows the user to modify memory allocation of interrupt vector information. 


Vector redirection is enabled by programming the NVOPT (nonvolatile option) register. For redirection to 
occur, at least some portion—but not all —of the FLASH memory must be block-protected by 
programming the NVPROT (nonvolatile protection) register. All of the interrupt vectors (memory 
locations $FFCO-S$FFFD) are redirected, but the reset vector ($FFFE:FFFF) is not. 
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For example, if 512 bytes of FLASH are protected, the protected address region is from $FEOO through 
$FFFF. The interrupt vectors ($FFCO-$FFFD) are redirected to the locations $FDCO-$FDFD. 


If an SPl interrupt is taken—for example—the values in the locations $FDEO:FDEI are used for the vector 
instead of the values in the locations $FFEO:FFE1. This allows the user to reprogram the unprotected 
portion of the FLASH with new program code, including new interrupt vector values while leaving the 
protected area, which includes the unchanged default vector locations. 


4.4.1 S19 File 


Because bootloader operation must be transparent to the user S19 file, another piece of intelligence is built 
into the PC master code (instead of the MCU slave). If the record in the interrupt vector table is detected 
in the user S19 file, the vector is relocated into the corresponding area in the relocated interrupt vector 
table. For example, if the user S19 file contains $2 interrupt vector at address SFFEA, such a vector is 
relocated to the $FDEA address in the relocated interrupt vector table. 


Using this method, the user S19 file does not need to be modified, but the lower address of the end of 
FLASH memory must be considered. 


Figure 17 illustrates HC9S08 interrupt vector table relocation. 
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INTERRUPT VECTOR TABLE 
RESET VECTOR (bootioader star) | OXFFFE BOOTLOADER CODE OXFFBO 
original interrupt vector table 
is empty (unused) 
its content is relocated 
OXFFCO 
OXFDOO 





RELOCATED INTERRUPT VECTOR TABLE 
















OXFDFE < 
OXFDEC 
OXFDEA 
OXFDE8S 


OXFDC4 
OXFDC2 
OXFDCO 






INTERRUPT VECTOR 30 


INTERRUPT VECTOR 31 


USER CODE 






START (RESET) 








INTERRUPT ROUTINE 1 


INTERRUPT ROUTINE 2 


INTERRUPT ROUTINE 30 
INTERRUPT ROUTINE 31 


Figure 17. Interrupt Vector Table Relocation Explanation (HCS08) 


4.5 User Code Start 


To provide a register setup similar to how it appears after MCU reset, the user code is started in an unusual 
way. 





4.5.1 Software Reset 


If the bootloader must quit and run user code, an illegal operation is intentionally executed (HCS08 illegal 
opcode $8D). This causes an illegal operation reset and the MCU restarts. During bootloader startup, the 
system reset status register (SRS) is tested. If a power-on-reset is not detected, the user code starts instead 
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of the bootloader code. This allows the transparent operation of all other resets (such as illegal address, 
etc.) with only a short additional delay caused by testing of the SRSR register and executing associated 
jump instructions. 


4.5.2 Hardware Reset 


In some implementations, a pin reset (caused by external reset pin) is a valid source of reset for the 
bootloader to start. This allows remote in-circuit reprogramming in embedded applications that are able to 
drive the HCSO8 MCU reset pin. 


4.6 'HCS08 System Limitations 


This section summarizes limitations that must be considered when using the bootloader with the user 
application. 


4.6.1 Memory Occupied 


One of the strongest requirements 1s to use the smallest code possible. Typical HC9S08 implementations 
are 432 bytes (minimal memory size that can be protected) plus another 64 bytes page for relocated 
interrupt vector table. 


The bootloader is placed at the upper end of FLASH memory, therefore, the only modification required in 
the user code is in the memory mapping (typically found in the linker parameter file). 


The HCS08 MCU signals the actual FLASH addresses available. The PC Bootloader software will warn 
before programming if the user code overlaps with bootloader code. 


4.6.2 Time Delay Upon Start-Up and Initial Communication 


The number of pins with specific meaning during bootloader start-up must be as small as possible. 
Especially in communication systems (e.g., those using a standard serial port), pin overhead is zero and a 
“certain character at a certain time method” is used. So, the bootloader waits a certain amount of time to 
receive an answer from the PC at startup. If none is received, the user code starts. The typical delay is the 
range of several hundred milliseconds. 


If this start-up delay becomes an issue for the final application, the user may modify the bootloader code 
and use a “certain level on certain pin” method instead. A simple test of the voltage level on the IRQ pin 
(or any other input pin) can be used to decide whether the bootloading sequence is required. 


4.6.3 FLASH Protection Technique Not Usable 


The bootloader uses a FLASH block protection technique to protect itself from being overwritten, 
therefore, this feature is not available for the user code. This includes FLASH memory security-related 
registers (namely NVPROT, NVOPT, and NVBACKKEY) used for protection and interrupt-vector 
relocation by bootloader. 
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5 FC Protocol, Version 3, Large M68HC08 
Implementation 


This section describes features specific to the protocol version 3 of bootloader. It is intended for large 
HC08s (with two or more FLASH memory banks or, more precisely, with two or more separated FLASH 


memory areas). The format of the Ident Command from version 2 is used; the rest remains the same as 
with protocol version 1 (HC08) — namely the Interrupt Vector Table Relocation. 


6 MCU Slave Software 


This section provides a detailed description of the three typical M68HC(S)08 bootloader implementations. 
All code is written in assembly language. Several selected targets and different features are described as 


Table 2. Target Implementation Comparison 




































































u 
159 <8o Se FLASH | FLASH 
: q >s ED | E Erase | Program 
MCU Family < Ea Clock Source o Es 53 scI Page Size |Page Size 
E E E eo To (in Bytes) | (in Bytes) 
s ad OO 
MC68HC908AP Yes, 
APB/AP16/ 592 sea CR different| No | Hardware | 512 64 
AP32/AP64 ” | version 
MC68HC908AB/AS/AZ 
AB32/AS32/AZ32 640 4.9152MHz XTAL No No Hardware 128 64 
AS60/AZ260 
E E RE 384 ICG Yes Yes Hardware 64 32 
MC68HC908GP 512 32768 Hz XTAL No No Hiaidnads 128 64 
GP32 or external clock. 
MC68HHCIOBGR Era E 
GR4/GR8/GR16 320 8MHz XTAL A Yes No Hardware 64 32 
GR8A/GR16A É 
(A Family) 
MC68HC908GT 
GT8/GT16 384 ICG Yes Yes Hardware 64 32 
MC68HC908GZ 
GZ8/G716 512 8 MHz XTAL Yes No Hardware 64 32 
EO RSRS 512 8 MHz XTAL No No Hardware 128 64 
MC68HC908JK/JL XTAL, RC Software, 
JKT/JL1/ 395 oscillator or ext. Yes Yes single-wire 64 32 
JK3/JL3 source possible 
MC68HC9OBJK/JL es; 
384 4.9152MHz XTAL | different No Hardware 64 32 
JK8/JL8 : 
version 
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Table 2. Target Implementation Comparison (continued) 













































































g — co 
[50 n 8 o Ee, s is Ea 
; N >s co q rase rogram 
MCU Family < so Clock Source o Es 53 scI Page Size |Page Size 
E E e £o To (in Bytes) | (in Bytes) 
s er OO 
MC68HC908JW 4MHz or 6MHz 
JW32 1968 STAL orroconaior Yes N/A USB2.0 512 64 
Software, 
MCeBrCaISLE 384 ICG Yes Yes single-wire 64 32 
LB8 . 
possible 
MC68HC908LJ Yes, 
LJ12/ 324 Ernst ls different No Hardware 128 64 
LJ/LK24 "| version 
MC68HC908KX 
KX2/KXB 384 ICG Yes Yes Hardware 64 32 
MC68HC908MR PLL with XTAL 
MR8 461 (4 MHz) No No Hardware 64 32 
MC68HC908MR PLL with XTAL 
MR16/MR32 461 (4 MHz) No No Hardware 128 64 
MC68HC9080B 
QB4/QB8 362/302 QB/QC ICG Yes Yes/No | Hardware 64 32 
MC68HC9080C 
QC8/0C16 387/3823 QB/QC ICG Yes Yes/No | Hardware 64 32 
MC68HC908QT/QY Software, 
QTI/QT4/ 320 Simpler ICG Yes Yes single-wire 64 32 
QY1/QY4 possible 
E a 512 32768 Hz XTAL No No Hardware 128 64 
MC9SO8AW 
HCSOSAW32/48/64 576 HCS08 ICG No Yes Hardware 512 64 
MC9S08GB/GT 
HCS08GB/GT32 576 HCS08 ICG No Yes Hardware 512 64 
HCS08GB/GT60 
MC9S08QG No (HW) | Hardware 
HCS08QG4/8 a a No Yes (SW) | Software ana Rd 
MC9S08Rx 
HCS08RD/RG/RE8 
HCS08RD/RG/RE16 335 16MHz XTAL No No Hardware 512 64 
HCS08RD/RG/RE32 
HCS08RD/RG/RE60 
6.1 MC68HC908KX 


The M68HC908KX Family has an internal clock generator (ICG) module. This allows a very effective 
implementation of the bootloader without a crystal. 
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The on-chip FLASH programming routines simplify the bootloader and improve memory use. The 
communication between the MCU and PC uses a standard serial channel (SCI). 


Comer 
SRSR RESET NNOT POR USER CODE 
SOURCE TEST START 


Y POR CAUSED RESET 


MCU CONFIG 
ICG, SCIINIT 


y EXECUTE ILLEGAL 
SEND ACK AND 
WAIT FOR ANSWER OPERATION 


| À 


TIMEOUT EXPIRED YES 
? 





















































NO 
Y 


DISABLE SCI 
WAIT FOR HI-LO EDGE 


Y 


MEASURE BREAK 
TRIM ICG, ENABLE SCI 








Y 
SEND ACK (1) 





Y 


WAIT FOR COMMAND (2) 




































































Y YES 
NO NO NO NO 
ERASE? WRITE? READ? QUIT? 
YES YES YES YES NO 
Y Y Y Y 
SEND IDENT DATA RECEIVE ADDRESS RECEIVE ADDRESS RECEIVE ADDRESS (2) 
1 , J y 
O) CALL ERASE RECEIVE LENGTH RECEIVE LENGTH 
ROUTINE IN ROM 
Y Y 
O) RECEIVE DATA SEND DATA 
Y Y 





CALL WRITE (2) 


ROUTINE IN ROM 


V 
() 


Figure 18. MC68HC908KX Bootloader Flowchart 











Developer's Serial Bootloader for M68HC08 and HCS08 MCUS, Rev. 8 


Freescale Semiconductor 25 


MCU Slave Software 


6.1.1 Internal Clock Generator (ICG) — Initialization 


The ICG is simple to initialize. Because the ICG is active and the clock monitor is disabled after reset, the 
only action required is the modification of the ICG multiply register. Then, the ICGS flag (bit 2) of the 
ICG control register indicates whether the ICG is stable after the frequency change. 


ICGMRINIT EQU S20 
MOV HICGMRINIT, ICGMR ; set 9.8304MHz BUS clock 
LOOP : BRCLR 2, ICGCR, LOOP ; wait until ICG stable 


6.1.2 Internal Clock Generator — Trimming 


Even though the trimming routine is in ROM, a small bug renders this code unusable; therefore, the source 
code has been taken and inserted in the bootloader code. 


Although AN1831/D provides the procedure for calculating the trim factor from the measured CPU speed, 
the code itself omits the final doubling of the number of cycles. 


FOLLOWING LOOP IS EXECUTED UNTIL THE END OF THE BREAK SIGNAL. THE BREAK 

SIGNAL LASTS 10 BIT TIMES. IF COMMUNICATING AT f OP /256 BPS, THEN 10 BIT 
TIMES IS 2560 CYCLES. EACH TIME THROUGH THE LOOP IS 10 CYCLES, SO WE 

EXPECT TO EXECUTE THE LOOP 256 TIMES IF THE KX8 IS IN SYNC SERIALLY WITH 

THE HOST. IF WE STAY IN THE LOOP FOR > 256 LOOP CYCLES, THEN THE KX8 

MUST BE RUNNING FASTER THAN EXPECTED, AND NEEDS TO BE SLOWED DOWN. IF WE 

STAY IN THE LOOP FOR < 256 LOOP CYCLES THEN THE KX8 MUST BE RUNNING SLOWER 

THAN EXPECTED AND NEEDS TO BE SPEEDED UP. THE AMOUNT THAT WE CHANGE THE 

CPU SPEED IS EQUAL TO THE NUMBER OF LOOP CYCLES OVER OR UNDER 256. SO IF 

WE GO THROUGH THE LOOP 240 TIMES, THEN WE ARE RUNNING 

(256-240) /256 = 6.25% FAST. EACH INCREMENTAL CHANGE WE MAKE TO THE TRIM REGISTER 
(ICGTR) WILL MAKE A 0.195% CHANGE TO THE INTERNAL CLOCK. THAT IS, INCREMENTING 
THE REGISTER BY ONE OVER THE DEFAULT VALUE OF $80 STORED THERE WILL 

DECREASE THE INTERNAL CLOCK BY 0.195%, AND VICE VERSA. 

NOW EACH EXECUTION OF THE LOOP OVER OR UNDER WHAT IS EXPECTED (256 TIMES) 
REPRESENTS AN ERROR OF 1/256 = .391% ERROR. SO WE'LL NEED TO DOUBLE THE 

NUMBER OF LOOP CYCLES AND USE THIS NUMBER TO CORRECT THE TRIM REGISTER. 

OUR PRECISION FOR TRIMMING IS THEREFORE 0.391%$. 





* * 








*oXH dO XD HO HO HH DHX E dd E dd x x 


The actual code adds an ASLA instruction which doubles the trim factor before the actual write to the ICG 
trim register. 





ICGTRIM: 
CLRX 
CLRH 
MONPTBA4 : 
BRSET 4, PTB, MONPTB4 ;WAIT FOR BREAK SIGNAL TO START 
CHKPTBA4 : 
BRSET 4, PTB, BRKDONE ;: (5) GET OUT OF LOOP IF BREAK IS OVER 
AIX EI ; (2) INCREMENT THE COUNTER 
BRA CHKPTB4 ;: (3) GO BACK AND CHECK SIGNAL AGAIN 
BRKDONE : 
PSHH 
PULA ; PUT HIGH BYTE IN ACC AND WORK WITH A:X 
TSTA ;IF MSB OF LOOP CYCLES = 0, THEN BREAK TAKES TOO 
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TXA ; FEW CYCLES THAN EXPECTED, SO TRIM BY SPEEDING 
BEQ SLOW ;jUP £f OP. 
FAST: CMP E$40 ;SEE IF BREAK IS WITHIN TOLERANCE 
BGE OOR ;DON'T TRIM IF OUT OF RANGE 
ASLA ;multiply by two to get right range 
ADD KS80 ; BREAK LONGER THAN EXPECTED, SO SLOW DOWN £f OP 
BRA ICGDONE 
SLONW : CMP ÉSCO ;SEE IF BREAK IS WITHIN TOLERANCE 
BLT OOR ;DON'T TRIM IF OUT OF RANGE 
ASLA ;multiply by two to get right range 
SUB “580 
ICGDONE : 
STA ICGTR 
OOR: 
RTS 


The complete explanation of the trimming procedure can be found in AN1831/D. See References. 


6.2  MC68HC908JK/JL 


MC68HC908JK/JL MCUs are among the least expensive in the M68HCO8 Family, and they have no 
hardware SCI. Therefore, a software SCI must be implemented. This allows the unrestricted selection of 
which pins are used for serial communication (the provisions are made in the code so an IRQ pin can also 
be used as an input serial line). 


The MC68HC908JK/IL Family has a RC version (an RC oscillator is used instead of a crystal). The 
bootloader”s calibration compensates for any speed variation. If the desired clock frequency is outside the 
specified range covered by the calibration system, the code must be modified. 


The MC68HC908JK/JL Family has on-chip FLASH programming routines. Using FLASH programming 
saves memory. 


The main program flowchart (Figure 19) is very similar to the previous case. 
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RESET Je 


SRSR RESET 
SOURCE TEST 


Y 


NOT POR 


POR CAUSED RESET 





MCU CONFIG 








Y 





SEND ACK AND 
WAIT FOR ANSWER 











Y 


TIMEOUT EXPIRED YES 
: ? , 


NO 
Y 





USER CODE 
START 














EXECUTE ILLEGAL 
OPERATION 








WAIT FOR HI-LO EDGE 








Y 





MEASURE BREAK 
CALIBRATE SOFT-SCI 





Y 





SEND ACK 


=—) 





Y 








WAIT FOR COMMAND 





Pe) 








YES 


NO NO NO NO 
IDENT? ERASE? WRITE? READ? QUIT? 























YES YES YES YES 
Y Y 
SEND IDENT DATA RECEIVE ADDRESS RECEIVE ADDRESS RECEIVE ADDRESS 

Y Y Y Y 

(2) CALL ERASE RECEIVE LENGTH RECEIVE LENGTH 

ROUTINE IN ROM 

Y Y 

CO RECEIVE DATA SEND DATA 
Y Y 

CALL WRITE (2) 
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Figure 19. MC68HC908JK/JL Bootloader 
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6.2.1 Software-SCI Transmit Char Routine 


A detailed description of the software-SCI transmit and receive subroutines is provided in this section. 
They both are based on a 16-bit timer and the output-compare event is polled in the background loop. 





SHIFT-OUT TRANSMT le 
CHAR INTO CARRY FLAG 


ENTER 
Es 
















































































































































Y SET 
TEST CARRY 
INITIALIZE, FEED AND V 
RUN 16-BIT TIMER CLEAR 
—— y END Pio TXD PIN HIGH 
Y TXD PIN LOW 
TXD PIN LOW =: sd Y 
Y CLEAR TIMER FLAG 
Y CLEAR TIMER FLAG 
SET BIT COUNTER V 
TO9 ira 
Y WAIT FOR 
WAIT FOR TIMER FLAG 
TIMER FLAG , 
Y TIMER FLAG 
TIMER FLAG N NO RECEIVED? 
RECEIVED? YES 
YE 
Y Ê STOP TIMER 
DECREMENT N = 0 y 
BITS AND TEST 
o (CC EXIT ) 








Y 





Figure 20. Soft-SCI Transmit Char Routine 


The two routines” souce code is shown in Figure 21. Other than a few counters, a 16-bit ONEBIT variable 
is used. It contains the actual length of 1 bit at the current communication speed in 16-bit timer clock 
cycles. This variable is initialized during the calibration phase (Slave Frequency Calibration). 
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RR RR RARA RARA RARA RARA RARA RH 


SCITX: 
PSHH 
PSHX 


BCLR 
LDHX 
STHX 
BSET 
BCLR 


TXDCLR 


MOV 
BRA 


SCITX2: 
LSRA 
BCC 


TXDSET 


SKIP2 
DATALONW : 


TXDCLR 


BCLR 
SCITX1: BRCLR 


DBNZ 


SCISTOP: 


TXDSET 


BCLR 
SCITX3: BRCLR 
EPILOG: 

BSET 


PULX 
PULH 
RTS 


7, TSC 
ONEBIT 
TMOD 

4, TSC 
5, TSC 


H9,BITS 
SCITX1 


DATALOW 


7, TSC 
7, TSC, SCITX1 


BITS, SCITX2 


7, TSC 
7, TSC, SCITX3 


5, TSC 


Figure 21. Software-SCI Transmit Char Routine Source Code 


and clear TOF 


clear timer 
run timer 


number of bits + 1 
jump to loop 


shift out lowest bit 


skip next two bytes 


and clear TOF 
wait for TOF 


and loop for next bit 


and clear TOF 
wait for TOF 


stop timer 


6.2.2 Software-SCI Receive Char Routine 


The software-SCI receive routine is similar to software-SCI transmit. When the 16-bit output-compare 
event is polled, the value of the receive pin is scanned. No provisions are made for stop-bit checking, 
framing check, noise detection, etc., mainly because of memory restrictions. Figure 22 shows the 
software-SCI receive routine flowchart, and the source code is provided in Figure 23. 
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Y 
FEED 16-BIT TIMER , 








Figure 22. Software-SCI Receive Char Routine 
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ERRAR RR RARA RARA RARA RARA RR 


SCIRX: 


BRRXDLO SCIRX 


SCIRXNOEDGE : 
PSHH 
PSHX 
BCLR 


LDX 
LDA 
LSRX 
RORA 
STX 
STA 


BSET 


SCIRX1: 


BRRXDHI 


BCLR 
MOV 


SCIRX2: BRCLR 


LSRA 


BRRXDLO 


ORA 


RXDLOW: LDHX 
STHX 


BCLR 
DBNZ 


BRA 


7, TSC 
ONEBIT 
ONEBIT+1 
TMODH 


TMODL 


4, TSC 


SCIRX1 


5; TSC 
H9, BITS 


7, TSC, SCIRX2 


RXDLOW 


ES80 


ONEBIT 
TMOD 


7, TSC 
BITS, SCIRX2 


EPILOG 


Figure 23. Software-SCI Receive Char Routine Source Code 


6.2.3 Macros 


Several macros are defined across the two code listings. They improve the readability or memory 
consumption (Figure 24). 
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1 


1 


loop until RXD high 


and clear TOF 


clear timer 


loop until RXD low (wait for start bit) 


run timer 


number of bits + 1 


walt for TOF 


shift data right 
skip if RXD low 
set highest bit if RXD high 


and clear TOF 


(idle) 


(highest bit cleared) 


and loop for next bit 
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SKIP1 MACRO 
DC.B $21 
ENDM 
SKIP2 MACRO 
DC.B S65 
ENDM 
BRRXDLO MACRO 
IFNE RXDISIRQ 
IFNE SCIRXINV 
BIH NI ; branch 
ELSE 
BIL AU ; branch 
ENDIF 
ELSE ; RXD uses normal I/O 
IFNE SCIRXINV 
BRSET RXDPIN, RXDPORT,N1 
ELSE 
BRCLR RXDPIN, RXDPORT,N1 
ENDIF 
ENDIF 
ENDM 
BRRXDHI MACRO 
IFNE RXDISIRQ 
IFNE SCIRXINV 
BIL NE ; branch 
ELSE 
BIH Wi ; branch 
ENDIF 
ELSE ; RXD uses normal I/O 
IFNE SCIRXINV 
BRCLR RXDPIN, RXDPORT,N1 
ELSE 
BRSET RXDPIN, RXDPORT,N1 
ENDIF 
ENDIF 
ENDM 
TXDCLR MACRO 
IFNE SCITXINV 
BSET TXDPIN, TXDPORT : 
ELSE 
BCLR TXDPIN, TXDPORT E 
ENDIF 
ENDM 
TXDSET MACRO 
IFNE SCITXINV 
BCLR TXDPIN, TXDPORT e 
ELSE 
BSET TXDPIN, TXDPORT e 
ENDIF 
ENDM 


; BRANCH NEVER (saves memory) 


; CPHX (saves memory) 


if RXD low 
if RXD low 
pin 
; branch if RXD low 


; branch if RXD low 


if RXD hi 
if RXD hi 
pin 
; branch 1f RXD hi 


; branch 1f RXD hi 


clr bit 


clr bit 


set bit 


set bit 


Figure 24. Software-SCI Macros Source Code 
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6.3  MC68HC908GP 


MC68HC908GP MCUSs have no on-chip FLASH programming routines available. Therefore, all FLASH 
programming must be done by the bootloader, as demonstrated in this section. 


MC68HC908GP MCUS are primarily targeted for use with a low-cost 32.768 kHz crystal. Because the 
frequency of the crystal is known, no calibration is performed, which saves MCU memory. Therefore, this 
MCU uses the Known MCU Communication Speed method. 


Figure 25 is a flowchart of the MC68HC908GP bootloader process. 
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RESET Je 

















SRSR RESET NOT POR USER CODE 
SOURCE TEST START 
y POR CAUSED RESET 
MCU CONFIG 
ICG, SCI INIT 











, EXECUTE ILLEGAL 
SEND ACK AND OPERATION 


WAIT FOR ANSWER 


Y 


ACK RECEIVEDN YES = 
BEFORE TIMEOUT 


NO 














Y 
SEND ACK =—(1) 








EE. 
WAIT FOR COMMAND «—2) 


Y 


NO NO NO NO 
ERASE? WRITE? READ? QUIT? 
YES NO 


YES YES YES 
Y Y Y Y 


SEND IDENT DATA RECEIVE ADDRESS RECEIVE ADDRESS RECEIVE ADDRESS (2) 


l Y Y Y 
















































































(2) CALL ERASE RECEIVE LENGTH RECEIVE LENGTH 
ROUTINE IN ROM 
Y Y 
RECEIVE DATA SEND DATA 
Y Y 
COPY ERASE COPY WRITE 
ROUTINE TO RAM ROUTINE TO RAM 
Y 
CALL WRITE 





DC —>——— 
ROUTINE IN ROM 


V 
(1 


Figure 25. MC68HC908GP Bootloader Flowchart 











6.3.1 FLASH Programming Routines 


The main code is similar to the previous implementation with the calibration phase omitted. The FLASH 
programming by the bootloader is shown in Figure 26. Three main subroutines are defined: 


* CPY PRG — copies the selected routine into RAM 
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* ERASE ALG — whole FLASH erase routine 
* WR ALG — whole WRITE erase routine 


Because the flow is straightforward, no flowchartis provided. Basically, the sequence of events is executed 
according to FLASH erasing/programming specifications. 


RELA RARA RARA RARA RARA RR 


CPY PRG: 
TSX 
STHX 


LDHX 
TXS 
LDHX 

CPY PRG Ll1: 
PULA 
STA 
AIX 
DBNZ 


LDHX 
TXS 
RTS 


ERASE ALG: 


LDA 
STA 
LDA 


LDHX 
STA 
D US 


LDA 
STA 
D MS 


LDA 
STA 
D US 


CLRA 
STA 
D US 


JMP 
ERASE ALG END: 


WR ALG: 
LDA 
STA 
LDA 


LDHX 
STA 


1 


STACK ; copy stack for later re-call 
SOURCE ; LOAD WRITE ALGORITHM TO RAM 
HPRG 

X 

Ei 


STAT, CPY PRG 11 


STACK 
; restore stack 
pd dd de e E E A 
$300000010 
FLCR ; ERASE bit on 
FLBPR ; dummy read FLBPR 
ADRS ; write anything 
X ; to desired range 
HTIOUS ; wait 10us 
4200001010 
FLCR ; set HVEN, keep ERASE 
HTIMS ; wait Ims 
4200001000 
FLCR ; keep HVEN, ERASE off 
ET5SUS ; wait Sus 
FLCR ; HVEN off 
HTIUS ; wait lus 
SUCC ; finish with ACK 
pd dd de e E e E A A 
$300000001 
FLCR ; PGM bit on 
FLBPR ; dummy read FLBPR 
ADRS ; prepare addresses 
x ; and write to desired range 
HT1OUS ; wait 10us 


D US 
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LDA 
STA 
D US 


LDHX 
TXS 
LDHX 
MOV 

WR ALG 11: 
PULA 
STA 
AIX 
D US 
DBNZ 


LDA 
STA 
D US 


CLRA 
STA 
D US 


JMP 
WR ALG END: 
END 


300001001 
FLCR 
HT5US 


HDAT 


ADRS 
LEN, POM 


% 
t1 

HT30US 

POM,WR ALG L1 


300001000 


FLCR 
HT5US 


FLCR 
HTIUS 


RETWR 


MCU Slave Software 


; set HVEN, keep PGM 
; wait Sus 


; prepare addresses 


; wait 30us 
; copy desired block of data 


; keep HVEN, PGM off 
; wait 5us 


; HVEN off 
; wait Ilus 


; finish with ACK (& restore STACK before) 


Figure 26. FLASH Programming Routines Source Code 


For improved readability, two timing macros (D US and D MS) are used in the code (Figure 27). 


RELA RARARARARARARARARALALALARALRLRLRLRLRLRLRLRA RARA RR 





D MS: MACRO 
LDA 
VeL2: CLRX 
VeLli: NOP 
DBNZX 
DBNZA 
ENDM 
D US: MACRO 
LDA 
VeLi: NOP 
DBNZA 
ENDM 
6.4 





1 ; [2] 
; 11] 
po ti] 

VeL1 ; [3] 

VeL2 > 3] 

Ni > [2] 
; 11] 

VeL1 ; [3] 


256*4 = 1024T 
| (1024+4)* (arg-1) 


+ 2 T 


4*(arg-1) + 2 T 


Figure 27. FLASH Programming Macros Source Code 


MC68HC908GR 


MC68HC908GR MCUS are smaller members of the MC68HC908GP Family equipped with ROM 
memory with on-chip FLASH programming routines available in the user mode. 
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MC68HC908GP and MC68HC908GR MCUS are primarily targeted for use with a low-cost 32.768 kHz 
crystal. Because the frequency of the crystal is known, no calibration is performed, which saves MCU 
memory. Therefore, these MCUs use the Known MCU Communication Speed method. 


6.5  MC68HC908MR 


MC68HC908MR MCUSs are motor-control oriented members of the M68HCO08 Family. The 
MC68HC908MR MCUS have no on-chip FLASH programming routines available. Therefore, all FLASH 
programming must be done by the bootloader. 


The MC68HC908MR Family has a PLL (phase-locked loop) circuit that can multiply the crystal 
frequency. Typically, a 4-MHz XTAL is used as the reference frequency. This implementation 
demonstrates how the PLL circuit is initialized for 8 times the crystal frequency. Therefore, the source PLL 
frequency is 32 MHz, and the bus frequency is 8 MHz. 


Because the frequency of the crystal is known, no calibration is performed, which saves MCU memory. 
Therefore, these MCUSs use the Known MCU Communication Speed method. 


6.6  MC68HC908GT 


6.7  MC68HC908EY 


The code for MC68HC908GT and MC68HC9O8EY MCUS is similar to MC68HC908KX code, except for 
the memory maps and ROM routine locations. One minor difference is that the MC68HC908GT Family 
cannot use the CGMXCLK clock as the SCI module source. Therefore, the bus clock is the only possible 
clock source. 


6.8  MC68HC908QT/QY 


MC68HC908QT/QY MCUS are the smallest members of the M68HCO08 Family. They have a simple ICG 
module (running on fixed frequency 12.8 MHz +25%). ROM routines are available. 


There are several spare FLASH locations (mainly among unused interrupt vectors) also used for storing 
the bootloader code. 


6.8.1 SCI Application Program Interface (SCIAPI) 


Software SCI communication is implemented on MC68HC908QT/QY, MC68HC9OBJK/JL and 
MC68HC908LB MCUSs to reduce cost and enable the user code to call the SCI send and receive routines 
(with certain limitations). The bootloader code now implements so-called SCIAPI, which is the defined 
way to call the SCI send and receive routines. 


The details, implementation notes, and limitations are provided in the sci .h file (of the QTQY folder). 
This file is the only resource that must be included in the user C code. The calling convention and overall 
usage is described in this file, too. The main limiting factor for most applications will be that the SCI 
receive routine is a blocking one. This means that routines will notreturn until an SCI character is received. 
The 16-bit timer registers are also manipulated. Some applications will use this code without problems. 
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6.8.2 'Single-Wire Communication 


Because of the small number of pins on MC68HC908QT devices, the single-wire SCI version has been 
developed to keep the number of pins occupied by communication to a minimum. Figure 28 illustrates an 
example single-wire RS-232 interface. The single-wire option has been ported to MC68HC908JK/JL and 
MC68HC908LB bootloader because they use a software SCI also. 





























VDD 
10k 

RXD 

< <— 

RS-232 M H T/QY 
CONNECTION TTL/232 SHIFTER o a 

> > 
TXD 


Figure 28. Example Single-Wire Schematic 
The bootloader's master side must be informed that the single-wire communication is used. This can be 
done by calling the hcO8sprg.exe software. Use the following extended calling convention: 


hc08sprg.exe 1:S filename.sl9 

where 1 specifies which COM port is used for communication, and S stands for single-wire. 
Original (old) format: nco8sprg.exe 1 filename.s19 

Now defaults to: hc08sprg.exe 1:D filename.s19 


where D stands for dual-wire mode. The bootloader master can also detect the presence of a single-wire 
interface if called: 


hc08sprg.exe 1:? filename.sl9 
The detection is only possible if the serial interface (mainly the level shifter) is powered up and working 


BEFORE the bootloading process starts. Because this is not usually the case, always specify the 
bootloading mode by including either a “:S” or a “:D” in the parameter. 


6.9  MC68HC908LJ 


MC68HC908LJ MCUs are members of the M68HCO08 Family used to drive LCD displays. 
MC68HC908LJ MCUs have the ROM on-chip FLASH programming routines available. The calling 
convention is slightly different from other M68HCO08s (see MC68HC908LJ data sheet, monitor ROM 
section). 


MC68HC908LJ MCUSs are primarily targeted for use with a low-cost 32.768 kHz crystal. Because the 
frequency of the crystal is known, no calibration is performed, which saves MCU memory. Therefore, 
these MCUSs use the Known MCU Communication Speed method. 
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6.10 MC68HC908AP 


MC68HC908AP devices are members of the M68HCO08 Family that have two SCIs (the SCI channel must 
be selected at compile time). MC68HC908AP MCUS have ROM on-chip FLASH programming routines 
available. The calling convention is slightly different from other M68HCO08s (same as MC68HC908LJ 
devices). 


Because of the internal oscillator” simplicity, it does not have the accuracy and stability of the RC oscillator 
or the XTAL oscillator. Therefore, the internal oscillator is not suitable if an accurate bus clock is required 
and it should not be used as the bus clock source. 


A low-cost 32.768 kHz crystal was selected as the default source clock for the bootloader and user 
application. Because the frequency of the crystal is known, no calibration is performed, which saves MCU 
memory. Therefore, these MCUs use the Known MCU Communication Speed method. 


6.11 MC68HC908AB/AS/AZ 


MC68HC908AB/AS/AZ devices are members of the M68HCO08 Family that also have EEPROM memory. 
This code also demonstrates the way how to program these EEPROM cells using AUTO (automatic clear 
of EEPGM) mode. 


Since the memory map is not continuous, FC protocol version 3 needs to be used (it allows the “holes” in 
the memory map, 1.e., several separate memory blocks). 


6.12 MC9S08GB/GT 


* | MC9S08GB/GT devices are the first members of the HCSO8 Family. Because of different hardware 
features and FLASH memory allocation, another version of the protocol was required. The 
protocol is detected automatically by the latest hc08sprg. exe PC Bootloader software and 
becomes invisible to the user. 


MC9S08GB/GT MCUSs have two SCIs (the SCI channel must be selected at compile time). 


These MCUs have no on-chip FLASH programming routines. Therefore, the bootloader must do all 
FLASH programming, and this implementation demonstrates this (it has been entirely adopted from 
HCSO08 Family Reference Manual Volume 1 (Freescale Semiconductor order number HCSO8RMvI/D; see 
References). 


6.13 MC68HC908JW 


HC908JW family has built-m USB 2.0 Full Speed module. It allows a direct connection via true USB 
interface with PC. As described in AN3153: Using the Full-Speed USB Module on the MCHC908]JW32 
application note, the emulation of the serial COM port can be easily designed. This way a fully compatible 
bootloader (written in C) for JW32 family has been designed. Once the bootloader is programmed into 
JW32 device, the user code can be reprogrammed anytime using native USB connection (serial COM port 
emulation in Windows). 


The installation and usage details are documented in ZSTARRM: Wireless Sensing Triple Axis Reference 
design, chapter 5.5 and 6.1.2, out of which the JW32 USB bootloader has been derived. The PC drivers 
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required for USB are also inside JW32 folder of AN2295SW software package. Alternatively the latest 
on-line version of PC drivers is available on the ZSTAR summary page (RD3152MMA72600). 


NOTE 
Although serial COM emulation on JW32 has been successfully tested in 
Linux, Linux port of hc08sprg executable of AN2295 bootloader master 
was not tested together with JW32 bootloader USB implementation. 


7 PC Bootloader Master Software 


This section provides a detailed description of the bootloader host computer master software, which is 
downloadable as a zip file from the Freescale Semiconductor website, http://www.freescale.com. All code 
is written in C language and is compatible with Linux and Win32º platforms. 





The bootloader specifications dictate that, as much as possible, intelligence is executed in the host 
computer instead of by the MCU, minimizing MCU memory consumption. Only primitive functions are 
implemented in the MCU. 


In this section, portions of the master bootloader code will be described in more detail. All actions required 
for reprogramming the M68HC(S)08 device are fully described in the slave implementation and protocol 
sections of this document. The specific master characteristics are emphasized. 


The host computer master software design is straightforward and is a sequence of several steps 
(Figure 29): 

* Opening serial port 

* Opening source S19 file 

e Waiting for reset of MCU 

e Calibrating MCU 

e Reading MCU information 

* Remapping MCU interrupt vectors 

e Checking if source S19 data fits into physical MCU memory 

* Erasing and programming MCU 

* Cleaning up, exiting program 
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74 


The following file structure is set up: 
8-Bit MCU Image Operations: 


START 


ENOUGH 
ARGUMENTS 





















YES 


OPEN 819 FILE 





Y 
N 
OK? E 


YES 
Y 








WAIT (HOOK) FOR 
MCU RESET 











Y 


YES 


File Structure 


— sl9.c 


UART Manipulations: 


— serial.h 


seriallinux.c (serialw32.c) 








CALIBRATE MCU 














READ MCU INFO 











Y 
OK? 


YES 
Y 





PRINT MCU INFO 





Y 








SET UP INTERRUPT 
VECTOR TABLE 














Y 


YES 


— System Platform Dependent Files: 


sysdep.h 


— sysdeplinux.h 
— sysdepw32.h 


Generic and Main Program Files: 


— hc08sprg.h 
— main.c 





CHECK 819 
IMAGE TO FIT 








DISPLAY WARNING 
IF NOT 














SURE? NO X($FF) 


YES 


Y 
PROGRAM MCU 


Y 
OK? x(8) 





YES 
Y 


UNHOOK MCU 
CLOSE UART 


Y 
EXIT 


NOTE: X(2) MEANS EXIT WITH EXIT CODE 




















Figure 29. Bootloader Master Flowchart 
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* M68HC(S)08 Specific Programming Files: 
— prog.c 


7.2 8-Bit MCU Image Operations 


To perform the necessary operations with the code, the master software keeps a binary image of the 
memory. Also, the information about whether an actual byte is to be programmed into the MCU is stored. 
This is done by following structure: 
typedef struct ( 

BYTE d[0x10000] ; // data 


BYTE £ [0x10000]; // valid flag 0=empty; 1=usercode; 2=systemcode 
) BOARD MEM; 


where image is the actual variable defined as follows: 

BOARD MEM image; 
After the source S19 files are read, this array contains the actual data to be programmed into the MCU 
irrespective of its original order in the S19 file. The function int read s19 (char *fn) definedin s19.c 


implements the S19 file opening, reading, and relocation from S19 hexadecimal format into this binary 
array. 


7.21 Interrupt Vector Table Relocation 
After the ident information is read out of the MCU, the following operations within the image are carried 
out: 


e The code is scanned to determine 1f any interrupt vectors are present between the MCU interrupt 
vector table address and 0xFFFF (the last existing physical address of the M68HC(S)08 MCU). 


e Jfinterrupt vectors are present, relocation of these vectors is done as described in Interrupt Vector 
Table Relocation. Then, the original address spaces in the interrupt vector table are marked as 
unused, thus, not being reprogrammed. 


These operations are executed in the function int setup vect tb1 (void) defined in prog. file. 


7.2.2 Checking Memory Boundaries 


The last check performed before the code is actually programmed into the MCU is to determine if the code 
from the S19 file is in the correct memory locations (between the memory boundaries reported by the 
MCU in the ident table). 


If any value outside the range of addresses between the start address of reprogrammable memory area and 
the end address of reprogrammable memory area is found, a warning is generated. 


This check is done in int check image (void) also defined in the prog. c file. 
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7.3 | UART Manipulations 


In seriallinux.coOr serialw32.c, depending on the platform used, the following UART manipulation 
functions are defined: 

int init uart (char* nm); 

int close uart (void) ; 

int send breaklo0 (void); 

int flush uart (int out, int in); 

int wb (const void* data, unsigned len); 

int rb(void* dest, unsigned len); 


The pair int init uart (char* nm) and int close uart (void) manage opening (initialization) and 
closing of the specified UART port. 


The pair int wb(const void* data, unsigned len) and int rb(void* dest, unsigned len) is 
used for writing and reading blocks of data into/out of UART. 


Two additional functions are required for the bootloader to work:, int send break10 (void) and 
int flush uart (int out, int in). The first sends a BREAK character to the UART, the second cleans 
up both directions (in/out) of the UART buffers. 


7.4 System Platform Dependent Files 


The header file sysdep .h includes either sysdeplinux.h or sysdepw32.h, depending on the platform 
software being compiled. The platform-specific declarations are then used. 


7.5 Generic and Main Program Files 


The header file hcossprg.h contains the rest of the generic declarations needed to compile the application. 
The file main. c contains the main program and is shown at the beginning of this section (Figure 29). 


7.6 ' M68HC(S)08 Specific Programming Files 


The most important part of the PC Bootloader software is contained in the file prog. c implements most 
of the intelligence of the PC bootloader software as mentioned in previous sections. 


Numerous routines are implemented in the prog. c file: 


int hook reset (void) 

int could be ack (unsigned b) 

int calibrate speed (void) 

int read mcu info (void) 

int setup vect tb] (void) 

int check image () 

int read blk (unsigned adr, int len, BYTE *dest) 
int erase blk (unsigned a) 

int prg blk (unsigned a, int len) 

int prg area (unsigned start, unsigned end) 
int prg mem(void) 

int unhook (void) 
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7.6.1 Initial Hook (Waiting for MCU Reset) 


Immediately after all initializations are done in the PC, a loop starts to wait for communication from the 
MCU. The int hook reset (void) routine implements all necessary steps to establish initial 
communication with the MCU. 


7.6.2 Checking ACK 


A routine int could be ack (unsigned b) checks if a received character fits the possible set of 
characters that can be received due to a communication speed mismatch (See Unknown MCU 
Communication Speed). 


7.6.3 Speed Calibration 


A speed calibration loop, implemented in the int calibrate speed (void) routine, follows the scenario 
described in Slave Frequency Calibration. Ifno ACK 1s received from the MCU, another break character 
is sent. 


7.6.4 MCU Info Reading 


Immediately after the calibration is successfully completed, the PC requests the Ident Command, to which 
the MCU responds with information about itself. This is achieved in the int read mcu info (void) 
routine. 


7.6.5 Image Manipulations 


The two functions, int setup vect tbl(void) andint check image (), are described in 8-Bit MCU 
Image Operations. 


7.6.6 Block Operations 


Three main data exchange operations are performed: 
* Erase block 
e Read block 
e Write (program) block 
These basic operations are implemented in the functions: 


int erase blk (unsigned a) 
int read blk (unsigned adr, int len, BYTE *dest) 
int prg blk (unsigned a, int len) 


The actual implementation is straightforward and follows the rules described in Interpreting MCU 
Commands. 
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7.6.7 Main Programming Loop 


The core of the bootloader”s programming capabilities is implemented in the function int 

prg area (unsigned start, unsigned end). This routine's task is to read data from an image and split 
the data into appropriately sized blocks (minimum erase/write block sizes). Then the erase block and write 
block routines are called, in that order. 


The routine also prints the progress information to the standard I/O (e.g., block boundary addresses, 
progress indicator). 


One additional auxiliary function, int prg mem (void), is included. It retrieves the lowest and highest 
memory addresses that must be programmed because those addresses are used for calling the int 
prg area (unsigned start, unsigned end) function. 


7.6.8 Final Unhook 


Function int unhook (void) sends out the Quit Command. 


8 Bootloading Procedure Demonstration 


The bootloader binary code (S19 file) is loaded in the MCU like any other regular 8-bit MCU (using 
MONO serial programmer or other, for HCSO8 using BDM interface). Then the MCU is soldered, or 
socketed, in the application. 


Using the bootloader pre-programmed into the MCU, the user can download the 8-bit MCU user 
application code via SCI interface using the bootloader utility. 
8.1 Bootloading Operation 


Open a command prompt in the Linux or Windows directory where the copy of hcossprg executable 
and S19 files are. 


Assuming the serial board is connected to, for example, a second serial port (COM?2, /dev/ttyS1) and is not 
yet powered on, invoke the bootloader using following sequence: NcO8sprg.exe 2:D test.s19 
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(WINNT' system32',cmd.exe - hcO8sprg.exe Z:D test.si9 


Microsoft Windows 20808 [Version 5.08.2195] 
<C> Copyright 1985-2008 Microsoft Corp. 


à :NICONNNtoolswhcB8sprgwmasterwRelease>hcH8sprg.exe 2:D test.s1? 

hcB8sprg —- Developer's Serial Bootloader for HC(S>88 - SUVersion: 1.8.22.85 
FC protocol versions supported: 1 c<HC0B8>, 2 <SB8>, 3 (large HCB8)> 

See Freescale Application Note AN2295. 


Waiting for HCB8 reset ACK... 





Figure 30. Bootloader Invocation 


The bootloader now expects the ACK command to be received from the MCU bootloader-enabled 
application. Then turn the power on for serial board and 1f all connections are OK, the MCU begins 
communication with the PC. The calibration procedure does not occur (the bootloader version with known 
communication speed is used), followed by IDENT command. The information that is acquired from the 
MCU is then displayed on the screen (Figure 31). 
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+ CHAINNTisystem32',cmd.exe - hc08sprg.exe 2:D test.s19 


Microsoft Windows 2088 [Version 5.08.2195] 
€<C> Copyright 1985-2000 Microsoft Corp. 


à :NICONNNtoolswhcB8sprgwmasterwRelease>hciBsprg.exe 2:D test.s1? 

hcB8sprg - Developer's Serial Bootloader for HC(S>B8 - SVersion: 1.8.22.85 
FC protocol versions supported: 1 (<HCB8>, 2 <SB8>, 3 (large HCH8)> 

See Freescale Application Note AN2295. 


Waiting for HCB8 reset ACK...received fBxfc (good)>. 

Bootloader protocol version: BxBi (read command NOT supported)> 
Bootloader version string: GP32 

fAivailable flash memory: Bx8000-BxFBFF 

Erase block size: 128 bytes 

Write block size: 64 bytes 

Original vector table: fxFFDC 

Bootloader user table: fBxFCRA 

Bootloader data Chex): 82 88 00 BA GA HA HA AA 


fire vou sure to program part? [v/Nl: u. 





Figure 31. First Stage of Bootloading 


Confirm by pressing *y” and bootloading (FLASH reprogramming) will continue. The user application 
will then start. 
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Bootloading Procedure Demonstration 


WINNT system32'%,cmd.exe 


Microsoft Windows 2088 [Version 5.08.2195] 
<C> Copyright 1985-2008 Microsoft Corp. 


A :NICONNNtoolswhcB8sprgwmasterwRelease>hci8sprg.exe 2:D test.si9 

hcB8sprg —- Developer's Serial Bootloader for HC(<S>DB8 - SUersion: 1.80.22.05 
FC protocol versions supported: 1 c<HC08)>, 2 <SB8>, 3 (large HCB8> 

See Freescale Application Note AN2295. 


Walting for HCB8 reset ACK...recelved Bxfc (Cgood>. 

Bootloader protocol version: fxBi (read command NOT supported> 
Bootloader version string: GP32 

fivailahle flash memory: Bx8000-BxFBFF 

Erase block size: 128 bytes 

Write block size: 64 hytes 

Original vector table: BxFFDC 

Bootloader user table: fxFCAA 

Jada fo he Pos Ta (=) E ES À rr O 17 O 2 ES E SS 


fire vou sure to program part? [vy/N]: y 
Memory programmed: 100% 


DS ER STR RAN TALES O de TU TES DI A ET ED 





Figure 32. Bootloading Completed 


8.1.1 Memory Boundary Overlap Example 


If the user tries to bootload an application that will not fit in the actual MCU memory, a warning is 
displayed. The user may decide to continue, but some memory locations would likely be programmed 
incorrectly (the user code is either out of available FLASH memory or it overlaps with the bootloader 
code). 
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References 


AVINNTisystem32*,cmd.exe - hcO8sprg.exe 2:D wontfit.s1i9 


Microsoft Windows 2008 [Version 5.08.2195] 
<C> Copyright 1985-2000 Microsoft Corp. 


à :NICONNNtoolswhcB8sprgwmasterwRelease>hcBBsprg.exe 2:D wontfit.s1i? 
hcB8sprg - Developer's Serial Bootloader for HC(S>B8 - SVersion: 1.8.22.85 
FC protocol versions supported: 1 (<HC08>, 2 <SB8>, 3 (large HCB8)> 

See Freescale Application Note AN2295. 


Waiting for HCB8 reset ACK...receilved fBxfc (good)>. 
Bootloader protocol version: fxBi (read command NOT supported> 
Bootloader version string: GP32 
Available flash memory: x8000-BxFBFF 
size: 128 bytes 
64 bytes 
» table: fxFFDC 
RES RR DI JS] 
RT: Fr: O (7 O A | E SS SS 


S19 image will not fit into available memory (Cat address BxBEBB>? 


fire vou sure to program part? [v/Nl: u. 





Figure 33. Memory Boundary Overlap Example 


9 References 


For additional information, refer to these documents from the Freescale Semiconductor website, 
http://www.freescale.com 
* AN2295SW: Contains all of the software files for this application note in a zip file. 


* HCSOSRMYvI: HCSOS Family Reference Manual Volume 1 

* ANT831: Using MCóS8HC908 On-Chip FLASH Programming Routines 

* AN2140: Serial Monitor for MC9SO8GB/GT 

* AN2498: Initial trimming of the MCO8HCO9OS ICG 

*  AN2504: On-Chip FLASH Programming API for CodeWarrior Software 

*  AN2508: Generating Clocks for HC908 MCU Families 

*  AN2545: On-Chip FLASH Programming Routines for MCOSHC908GR/GZ 
*  AN2637: Software SCI MC6SHCO9OSQT/QOY MCU 

* AN2635: On-Chip FLASH Programming Routines for LB8 and other FLASH-based MCUs 
* AN2874: Using MóÓ8HC908 ROM-Resident Routines 

* AN3153: Using the Full-Speed USB Module on the MCHC908JW32 

* ZSTARRM: Wireless Sensing Triple Axis Reference design 
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